Episode 40 · · 37 min
John Gates From Car Mechanic to Lead IT Security Analyst
Lead IT Security Operations Analyst at a Fortune 500 food manufacturer
Episode summary
John Gates is a Lead IT Security Operations Analyst for a global food brand. John has always liked to know how do things work - and that has proven to be a beneficial trait - from his first job as a car mechanic to IT consultancy and education to his current role. He’s also an advisor and former board member at OpsecEdu, an organization educating technologists in state, local, and education agencies on security best practices.
Before infosec: Car mechanic, IT consultant and K-12 school IT lead
Chapters
- 0:00
Intro: John Gates and the K-12 to corporate move
Ayman introduces John, his global security role and his path from car mechanic to school IT.
- 2:14
Life as a lead security operations analyst
John describes his team's 35,000 devices, firewalls and load balancers, and the culture shock of leaving K-12 for a corporate environment.
- 4:12
War story: stopping the ILOVEYOU worm
As a consultant he read the VBS code and built a registry fix to block SMB share discovery, saving a client an estimated 15 million dollars.
- 6:08
From car mechanic to IT consultant
John explains how fixing things growing up, early computers and networking classes led him from an auto shop into a 1999 consulting job.
- 8:53
16 years in K-12 and building a security role
After the dot-com crash he ran school IT and created security awareness training for 400 staff without having a security title.
- 11:00
Selling security to boards and managers
John says the hardest part is explaining risk in plain terms in a few minutes and building rapport with managers.
- 14:11
Leaving the public sector: degree and CISSP
He explains why he went back for a bachelor's degree and why a degree beats the CISSP for getting past resume filters.
- 17:42
Interview lessons and a bad interview
John covers multiple interview rounds, staying confident, admitting what you do not know and not speaking negatively about a past employer.
- 23:20
OpsecEdu and security in K-12
He describes OpsecEdu, why insiders are the main threat in schools, and how tiny budgets force creativity.
- 27:51
Day to day work and the first real fire
John talks about change advisory boards, reporting directly to the CISO and dealing with a serious incident two weeks into the job.
- 31:55
Advice: fundamentals, certs, NIST and interviewing
He recommends knowing how computers work, getting a degree or certifications, learning the NIST frameworks and practicing interviews.
- 36:14
Closing: Ayman's new community
Ayman thanks listeners and asks them to check the show notes link for his new community.
Key takeaways
- Learn how technology works from the ground up, including how a computer works, before specializing in the security stack.
- Practice explaining risk and mitigation in business terms, because executives and boards give you only a few minutes.
- A bachelor's degree in a computer-related field or certifications such as CISSP and SANS courses help your resume get past automated filters.
- Expect several interview rounds, stay confident and honest, and frame past setbacks positively instead of badmouthing an employer.
- Know the NIST and other common security frameworks so you can answer risk and standardization questions in interviews.
- Create security work in your current role, such as awareness training, to build experience before you have a security title.
Notable quotes
I think that everybody that gets into infosec or hacking or anything like that really needs to understand how things work.
It is not talking on a real high technical level, but being able to explain risk and mitigation and what you're actually presenting and how that helps limit risk for a business.
we enable the business to be successful and we provide the breaking mechanism, so to speak, so the business can go fast, but it doesn't crash.
Questions answered in this episode
- How did John Gates go from car mechanic to security analyst?
- John did the computer work at an auto repair shop, then went to school for networking and took a consulting job in 1999. He later spent 16 years in school IT, created his own security role and then moved into a lead security operations analyst job at a global food company.
- Is a degree or the CISSP more useful for getting a security job?
- John says the CISSP helps to a degree, but a bachelor's degree in anything computer related helped more because resume-screening software drops applicants who lack it. He notes younger tech companies care less and just want to know if you can do the job.
- How should you prepare for an infosec interview?
- Expect several rounds of phone and in-person interviews, be confident, smile on calls, and ask for a question to be reframed if you do not know it. Know the NIST frameworks and practice answering questions out loud, even in front of a mirror.
Show notes and links
Show the original episode notes
John Gates is a Lead IT Security Operations Analyst for a global food brand. John has always liked to know how do things work - and that has proven to be a beneficial trait - from his first job as a car mechanic to IT consultancy and education to his current role. He’s also an advisor and former board member at OpsecEdu, an organization educating technologists in state, local, and education agencies on security best practices.
LINKS
Linkedin: https://www.linkedin.com/in/johngates/
OpsecEdu: https://www.opsecedu.com/
Intro Music: https://trash80.com/#/content/133/weeklybeats-2012-week5
Full Show Notes: https://www.gettingintoinfosec.com/john-gates-from-car-mechanic-to-lead-security-analyst/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
When you're in K-12, most of your adversaries are already in your network. It's already students that are inside the network that pose a significant threat
Welcome to Getting Into Infosec. I'm your host, Eamon Elsois. My guest today is John Gates. John is currently the lead IT security operations analyst at a global food manufacturing corporation, where his team is responsible for 35,000 devices worldwide.
The biggest challenge is making the business or making the educational institution understand why they need what you're presenting.
Before this, he spent 16 years as manager of information systems in a high school, employing the passion for infosec he acquired in years prior, working for a consulting firm operating in the financial sector. However, John's career started as a mechanic at a car repair shop.
I was doing all the computer work in the automotive shop, you know, doing the updates and things like that. And I guess it just one day I thought, I'm like, probably make a lot more money, you know, and I'm a lot more interested in not having my hands dirty every single day.
We talked about crucial traits in education you could obtain if you want to work in infosec and how his previous job in education equipped him with the skills he uses today. John also shared his job interview tips and recalled a war story where he saved thousands of computers at his company from a dangerous worm.
There was no group policy back then. The way I did it was sneaker land on about four levels and four floors worth of machines. All right, on to the show.
Hey, John, welcome to the show.
Hey, glad to be here. Thanks for having me.
Yeah, absolutely. Thanks for coming on. So maybe you could tell us a little about yourself and what you do today in security.
A little bit about myself is I live in Yorkville, Illinois. I'm a father of seven, but that's a whole nother podcast, I guess.
That's awesome.
But yeah, all girls and one boy.
Oh, wow. Cool.
So, yeah, right now I'm currently lead IT security operations analyst in the global threat management team for a Fortune 500 food manufacturing corporation. And I've been in that job a little over a year and a half now.
Okay. And what's life like in your daily role?
Yeah, I was going to say I came from the education K-12 background. So the corporate cubicle, you know, thousand people in a building was quite an adjustment for me. Coming from an environment that I had full access to everything, pretty much, it takes multiple meetings and stuff just to get basic access on things. So while it's restricted, it's still quite challenging. We're responsible for about 35,000 devices. So it's a very large environment.
And that's devices worldwide, I'm assuming?
Correct. Yeah, that's firewalls, load balancing devices, and things of that nature.
And so you're dealing with more on the threat prevention side, or are you responding to threats?
Yeah, I kind of fit both roles. So I deal with threat response as well. But I do deal with the detection and mitigation as well.
Oh, I see.
So I kind of move around. I have a unique skill set. Having come from K-12 security and the main reason why I actually changed jobs, I worked 16 years for a high school in Roselle, Illinois. And I ended up doing more security-based stuff because of my role as a programmer in building credit card processing systems. I mean, I had always been security-driven. And I guess to take a step back from that, before the school, I worked back in 1999-2000 for a consulting company where I basically did a lot of work around the financial sector, ABN Amro, Chicago Board of Trade. And that's really where my interest in security itself really came out. It was exciting to go to a location and have to go through man traps, you know, and retinal scans to even get access to security areas.
So I did have a security background before it was sexy, so to speak. It's like security is more on the forefront now. I wish it would have been more that way in the past, like to bring up a story and talk about a war story. Well, it's kind of one. Yeah. So I was working for Omnitech Corporation. I don't know if you remember that company. They were a computer manufacturer, but they also offered professional services.
Okay.
And I happened to be on a secondment with them and doing work at Navistar Corporation.
Okay.
Around May 5th and May 6th. That's the time that the I love you virus, if you remember that one, Kind of struck and i actually saved that company about 15 million dollars because i was able to read the code in the vbs script and build a registry fix that would work on nt4 machines nice at the time okay and servers and was able to thwart a disaster like that so i mean it's 20 years ago and yes i'm an older guy so probably date myself with that one but
What was the registry fix? What was it that you did and then what prevented it? Basically, you prevented the spread, I'm assuming. So you found out how the virus was spreading and you wrote a registry fix to prevent the additional spread. Is that right?
Yes, to prevent the discovery of SMB shares. Probably I'll send you an actual modification. It'll probably be easier than trying to talk about it so that you can post it with this to tell you what I did to actually mitigate it. Great. It prevented the shares from being propagated.
Okay.
It is the longer, shorter that.
Okay, great. And you rolled that out. Through group policy, I guess, at the time?
No, there was no group policy back then. The way I did it was sneaker land on about four levels and four floors worth of machines.
Oh, wow. Okay, cool.
Yeah, fortunately, not too many people were clicking the email, if you know what I'm saying. So it was easier back then.
So were you always in a tech job?
So I grew up in a family where we didn't really have a lot of money and you learned to fix things, right? Or they were broken and you just didn't have them. The reason I mentioned that is I think that everybody that gets into infosec or hacking or anything like that really needs to understand how things work. So I actually came from a mechanical background, auto mechanic background. My first job was in 1999, where I went, like I said, for the computer consulting, where I was going basically to SIBO and ABN Amro, you know, in the financial district.
Okay.
So yeah, I did quite a bit of time, but it's good because I knew foundationally on how things worked. I did go and take networking classes and things like that. And I think that's also important to understand how the computer works, you know, overall is another, you know, core skill. You really need to have a solid base before you can go to higher understanding on the security stack and how that plays into everything.
And so how did you transition from the mechanical side to computer?
You have a computer at home?
Oh yeah.
Okay.
Yeah. From the time I was like 12 or 13 years old, I had computers around all the time. The Commodore 64 y'all remember, but I actually had the first one before that, which was a Vic 20.
Okay.
Kind of laugh about it when I think about it now, but no, I was always around computers and I think I was doing all the computer work in the automotive shop, you know, doing the updates and things like that.
Oh, okay.
And I guess it just one day I thought I'm like, probably make a lot more money, you know, and I'm a lot more interested in not having my hands dirty every single day and things like that. And that's kind of when I decided to go back and I went to school for networking specific. That was about in 87. So around 89, 90, or no, 98, 99 is when I got into tech job to start with.
Gotcha.
So yeah, it was a tough move. And everybody was kind of like, are you sure?
I mean, I just did soldier through.
And did you get a lot of rejections?
Oh, yeah. At first, it was hard to land my first job. But like I said, the job that I finally did land was the most beneficial for me in the way I learned because I would just be thrown, you know, I'd never work in the same place two days in a row and always thrown into a new environment and a new situation. So for me, that just worked.
Consulting is really a good way to get exposed to a lot of different environments. It's a high burnout factor. Basically, double the experience you would. So in two years, you get practically four years of experience, right?
Yeah, I would agree with that 100%. But that also plays into the dot-com crash that happened. And I had never really lived. I implemented tens of thousands of solutions, but never really lived with the implementation and actually stayed with it. And that's when that crash happened. The company that I worked for went under. That's when I went to the school district. And I actually spent 16 Years in K-12 for information technology specific. So I programmed credit card systems, processing systems for payments, ran the networks, and basically did the job of a technology director without that. Without that specific role.
Okay. And did you have a security role there or was it kind of ad hoc?
I kind of built a security role. That's very tough trying to sell. And that's another skill that you really need when you get into infosec and land. It is not talking on a real high technical level, but being able to explain risk and mitigation and what you're actually presenting and how that helps limit risk for a business. I was able to actually do an information security awareness training for 400 staff members that were at the school. So I kind of built the role. There was never a specific security role, but there was definitely a need for people to be made aware of email scams and scams on the phone and just things in general. So I kind of built that before I left.
You have to choose your battles, right? And deciding what to raise the alarm for. Or otherwise, if you're raising the alarm for everything, you could be considered like a chicken little and always complaining about the sky swallowing.
Correct. And definitely whatever you stand behind and you push forward, you need to make sure that gets executed in its entirety and that it actually limits or minimizes the risk that you presented. And you have to show that or the next time you try to get something, you're not going to get the funding for it either.
Let's talk about some of the challenges because sometimes to transition into security, you have to kind of do some of the security stuff in your role, even though you don't have security in your title. So walk us through some of the challenges you had, given that security was not your official designation there, you know, trying to get some of these initiatives done.
The struggles really are with what you'd call upper management in the regular corporate world. It was a board of directors. So really, that's the biggest challenge is making the business or making the educational institution understand why they need what you're presenting, how it limits risk. Overall to the educational facility or business. And that's really the biggest challenge is saying it and speaking in understandable enough terms and not going too far into the technical side because you get about Probably three to five minutes, you know, with those people in those roles. And if you don't sell yourself and you don't sell the risk mitigation in what you're proposing, then you're back to the drawing board again.
So the biggest thing was learning how to interface with them. C-level people.
What if it's just trying to get past your manager and convincing them? Have you run into any challenges like that or you could talk about that?
I personally didn't run into any challenges. My manager in that job when I didn't have the security specific role was really empowering and kind of as long as I was getting my work done, Really left me to do what I needed to do. So that was never really a challenge for me personally. It was always selling that to the school board or the superintendent, people in those roles.
And so what if you did have a difficult manager? What would your advice be to those who are trying to do more security but are getting shut down by their managers right from the get-go?
Yeah, it really depends on the basis for the pushback they're giving. If it's a budgetary thing, that's a hard one to get around unless you go with the, well, can you consider it maybe for next year's budget, kind of go around there. But if it's just the technology itself, maybe it's the way that it's being presented that That it's not being presented to the manager in a way that they understand and they could convey it to the higher level people. So maybe a thought on what you're trying to convey and how it helps limit risk for the business and then how you put that together and present it.
Yeah.
I think is most important when it comes to that. And really, it's your personal, you know, what's your rapport with your manager before that, with any kind of difficult situation before anything like that even starts or comes in. Also comes into play. You have to really build a good baseline with a superior before you'll be heard fully. I mean, if that makes sense.
Yeah, I think there's a lot of empathy. Sometimes a manager, they have their own issues that they're dealing with, right? From a managerial perspective and a lot of fires that they're putting out. And so really understanding things from their perspective. And I think what you're saying is in any case, when you're trying to convince someone else of something, you need to understand their language and speak their language, right?
That is correct.
Yeah. And so walk us through. So you working 16 years for public school, one would think that's a lot of government bureaucracy and things like that. But you're saying you actually had a lot more freedom. And so what I'm trying to understand is your transition from the public sector to private sector and how that went.
Yeah, well, the main premise to that is, like I said, I had a lot of freedom in the prior, but I wasn't really able to expand things as much as I wanted to. So we got a little ways with the security awareness training and getting we got actually the platform know before is what we actually installed there to actually deliver the email simulations and things like that. With my other work that I was doing, I didn't have as much time for the security aspect as I wanted to, and they weren't really making a role available. If you know what I'm saying, that would be able to specialize in that and maybe not do what I was doing anymore. Right. And that actually, I didn't have a college education at the time.
I do have a bachelor's now. But at that point, and I got to that moment, I started just really rethinking things. I mean, I could have stayed with the school, right? You know, put my 20 years in and collected a pension and been done. But I wanted to give more and do more security focused work. And that's why I went back to school for cybersecurity and information assurance. You Have a CISSP certification. We can talk about how useful or not that is when you're applying for jobs.
How is it?
Well, I mean, it helps to a degree, but really, to be honest, that bachelor's degree in anything computer related is way more helpful. I got to be honest.
Why is that?
I think that when you go through a resume, there's software that goes through it, right? And I think that if you don't have those key things, you just get dumped and you never even get looked at.
Okay.
Because before any of that, I'd get job offers here and there, but I get 7 to 10 job offers a day now. Okay.
Just because you have the degree.
Right. I mean, I had a wealth of experience in years, but the degree makes a difference. It honestly does.
That's interesting. I wonder if it varies by region, different type of corporations, you know, maybe have different priorities, like, you know, the older, more traditional corporations may have some of those things versus some of the younger and quote unquote hip corporations. What do you think?
Yeah, I think younger and we're talking millennial. I don't think that college degree matters at all. It matters if you can do a job that they have. So they're offering a job. Can you do that job? I think it's different in the younger tech.
Crowd. Okay.
But bigger established companies, you know, fortune 500 companies, you know, they're going to give you scrutiny if you don't have that education. I really believe that.
And so when you were transitioning out of the school, at some point you decided, okay, I want to go. Did you try to apply and then found yourself stuck and then decided to go get your bachelor's or what was the transition period or that thought process there?
I decided to go back to school before I even started looking just because it's something that as a personal goal, I had never accomplished it previously. And I just wanted to have that.
Gotcha.
I wanted to have that goal, you know, attained and done. And really, when I got the job that I've got now, I didn't have that degree.
Oh, okay.
So I guess that levels that off.
So that's good to know. So how was the interview process then when you were looking to transition? When you decided, hey, I want to do something more security specific. How were interviews like? Did you get a lot of rejections now? What's life like now?
Yeah, I did get quite a few rejections. And the company I work for now... It had a very unique interview process. So it wasn't a single interview. It was numerous. Yeah. Numerous interviews over the phone until you got down to... I didn't know it at the time, but it was the last two people when I actually went in for an in-person interview. And then the day after that in-person interview, I was told I had the positions. So be prepared like in any job, be prepared for numerous interviews. Make sure you're smiling on the other end of the phone, even though nobody can see you per se, because it changes your voice in the person's perception of you on the other end. You don't sound humdrum or whatever.
Make sure you're smiling.
That's absolutely right. Yes, I'm glad you said that because that is actually a little tip. You got to smile and like, you know... Even move your hands and be like, you know, animated as you would be in person on the phone.
Yeah. And be confident and just know, you know, you're just having a conversation, right? Like a lot of people get real nervous in interviews and really you don't want to exude super amounts of nervousness because, you know, the companies that you're applying to and you're interviewing with are trusting you with their information security, right? So they They want you to be confident when you're speaking and talking with them, too. I guess that's a good point.
Yeah. And that's a good point you talk about. They're entrusting you with information security. Do you think information security jobs are a little more scrutinous than, say, a regular tech job in the interview process?
I think so, just because the questions that are asked are much different from other jobs, you know, in other roles that I've interviewed for. Information security, it is more scrutinous in how you handle data and not just how you handle data, but just trying to think of the word for it. The integrity of the person really comes into play. And they ask you questions that really try to get down to your scruples, you know, and are you a person of integrity or not? So that does come into play strongly. Interesting. Okay.
So I'm sure there were interviews or there were questions that people would ask you that you didn't know. And how did you handle questions that you didn't know?
Well, you have to be honest. If you really don't know what they're asking, the first thing I'll ask to do in an interview is actually have them reframe the question or ask them once again, just to make sure I'm completely getting the question that they're asking. And if I don't know after the second time with the question, I just honestly tell them, you know, I don't have a lot of experience with that. Honesty goes a long way with that. Or if you can frame the question that they've asked you, maybe you don't understand exactly what they're asking for, but you ask another probing question in regard to something that you do have experience in that might be akin to the question they're asking. Sometimes that loops in another conversation and gives you an opportunity to shine at that point and really talk about something that you do understand that's akin to what they were asking.
Okay. Can you tell us some bad interviews that you had that just didn't go well?
Yeah. This is in the rounds around the time where I was trying to leave and get into infosec. And it was actually IT-specific when the company was going out of business. I guess in the interview, one of the things that I learned is the worst thing to say is that the company that you worked for went out of business or just negative things. You
Even though it's a negative thing, you have to figure out how to frame that verbally positive and still get the same message across.
Right.
Like maybe they were having financial struggles, you know, instead of saying that just the company and you just outgrew it and you just wanted more of a challenge, you know, wording things differently so they don't have a negative connotation. Because I think that blew the interview for me, quite honestly.
What did you say exactly?
I basically said, oh, well, the company went out of business and I could just tell by the body language of the interviewers, because there were two people I was interviewing at that time, you know, the shoulders lowered and they kind of, you know, gave a sigh out.
Gotcha.
Which told me. Said wasn't received well.
Gotcha. Yeah, definitely a need to spin things. It's interesting. I mean, even badmouthing, you know, especially badmouthing your previous or current employer, you know, that's never a good sign in an interview, right?
No, absolutely not. Actually, Actually, in my younger years, I made that same mistake too. Yeah, it's just not good. Because that just shows that maybe you were the problem, right? And maybe it wasn't so much the company that you came from. Or maybe we haven't learned enough at that time. It shows immaturity, I would say.
Right. And unprofessionalism. Yeah, I mean, it might be true, but there's always three sides to a story, you know, your side, their side, and then the actual truth. But regardless, bringing that up in an interview might not be helpful.
No, not unless you have a way to add positivity to it or how the happening improved you as a person and how that can help the company that you're applying for now do the job that they're looking for an applicant for.
Exactly. Yes. It's about marketing, spinning something, right? Spinning something bad into something good. So at the end, you're just marketing yourself and trying to show them the best of you and how it could help them in their job.
And how you're better than the other people applying. Absolutely.
Right. Yeah. So the way I came to know about you is through OPSEC EDU, right? Yeah. And OPSEC EDU, I think in previous episode, Jared talked about it, but give us an overview of what OPSEC EDU is. And I think right now you used to be on the board. Now you're an advisor, but just give us a really high level of OPSEC EDU if you can.
Yeah, will do. So, yeah, I was on the board until I changed out of the K-12 realm and got in the private industry. I'm still an advisor with them. And what they do is kind of it's a consortium and schools get together and talk about information security issues that are affecting them. And also when defects or vulnerabilities are found in software. It's a place that gets communicated as well so that schools can better protect themselves. Because schools, the different focus is when you're in K-12, most of your adversaries are already in your network. I mean, it's already students that are inside the network that pose a significant threat. Correct.
That's really interesting.
Right. The outside gets overlooked sometimes. So that community kind of helps bring awareness to, hey, you know, holistically, you need to look at the network from the inside and the outside.
So it gives insider threat a whole new meaning.
Correct.
Okay. In coming to learn more about K-12 from Jared and Paige and Nathan and everybody else and yourself. I really think that the K-12 security community are really the grassroots. I mean, you folks are somewhat limited in a way, but I think you really have to innovate a lot, you know, in talking with multiple guests in this realm. I found there's a lot of innovation here. You know, what comments do you have regarding that?
Yeah, you really have to innovate because there's just no money for this. And when they budget, if it's not directly impacting or changing the outcome for a student's grade, right, or impacting education, it's really, really hard to sell a preventative solution for security. It That leaves K-12 education support people that have to come up with creative ways to address problems, you know, leveraging open source or free software. That's the big sticking point is they just don't have the budget to get things done.
And it's similar. I mean, even Nick told me about some really interesting things that he did. So I guess it's similar to startup security where startups really don't care. Obviously, there's an asterisk, but for the most part, startups really want to get their product out. And so security is like kind of like second place oftentimes or budget is limited. And so really trying to leverage open source and some of the being innovative in that regards.
Yeah, I totally agree. And a company that's not K-12 that's actually going through that pain point is Zoom now, isn't it?
Yeah. Yeah, but they're publicly traded. I guess they have some money, but yeah.
Yeah, they're going to need to because it costs a lot more to build security into a product after it's launched than to build it to begin with.
Oh, yes. In that regards, yeah. The known mantra of security is much costlier down the road than earlier. Baking security early is cheaper from a resources and time and money perspective. Yeah. Absolutely. Definitely. That's very well known. And your background in K-12, how has that helped you in your private sector job now?
Well, it helps with insider threat, but it also helps with keep in mind, like with K-12, there were people with valid credentials, right? So you start to learn in what I learned most, and I think most benefits me in corporate now is learning lateral movement and understanding behavioral things. Then what does this user account normally do versus has that deviated from that behavior? And if so, why? I ask those questions. Yes.
So you have that edge, I guess, is what you're saying.
Yeah, I feel it's an advantage because, you know, trust no one, verify everyone.
Do you find yourself being the chicken little as far as like having that extra spider sense for internal threats?
I don't know if it's so. I wouldn't frame it as chicken little. I think it gives me some insight and it's definitely helped because it's brought some things to the surface. I actually found a vulnerability in one of the applications that we use based on that behavioral type analysis. So definitely interesting. It's listened to. I think if I called fire too many times and there was nothing to extinguish, that would be one thing. Then it might be, you know, the sky is falling, but no, it's been pretty good.
Yeah. I guess you're more experienced now. Cool. So back to today, now that you're doing information security in the private sector, As a lead IT security analyst for a global company, walk us through some of the things you're dealing with, like, you know, some exciting things, some of the boring things, you know, everything. Just walk us through life in your shoes on a day to day or week to week basis.
So, yeah, we basically started our day off looking through emails, finding out if anything has come over the wire overnight or during things. We are change managed. And I don't know if the listeners are going to know what a cab is or change advisory. But basically, one of the things that I had to learn most coming from K-12 environment, right, and then going into a big corporate environment is patience, right?
Oh, OK. Yeah.
Yeah. Things that we change in the environment, whether it's a firewall, whether it's a policy, it goes through a change advisory board and has to be approved before it's implemented.
Oh, wow. OK.
So, yeah, like I said, patience is a big one. But yeah, a lot of times we're modifying firewall rules or changing things to enable the business, right? Because overall and after all, what we do in security is we enable the business to be successful and we provide the breaking mechanism, so to speak, so the business can go fast, but it doesn't crash. So that's the way I like to frame that part of it out.
Would you consider yourself the front lines for security or, you know, what does the security organization look like? Do you report to IT or does everybody wear many different hats or are you kind of just in your own lane?
I'm in my own lane, honestly. And our team, because we're global, we actually report right to the VP, the CISO of the company. So, yeah, there's no middle tier. We basically report right to senior leadership.
That's great.
Yeah, it takes a few hurdles out of the way, that's for sure.
And then do you get exposed to other co-workers, their environments and what they're working on?
Well, more so before this whole COVID-19 thing hit, right? We'd go to an office that's located nearby and have interactions and stuff. But yeah, we basically, as far as threat response, we have vulnerability management, threat response, and then... My role is more, you know, sustainment and maintenance, but I also do go into those other areas too when needed. So we do get exposure to more than just, you're not just doing firewalls or load balancers or...
You move around.
Okay. And is there an interesting story that you could share with us on your recent time there?
Nothing I can really talk about on the podcast. I apologize.
No, that's fine. Let me ask you this. How long was it before you had to deal with your first real fire after you started your job?
That's pretty interesting that you say that. Basically, I was told that, hey, this certain thing doesn't really happen that often. And then all of a sudden, two weeks into the job, it happened.
Okay.
So yeah, I did not get much of a hiatus before something serious enough happened that I had to scope up. But I did well. And like I said, I've been there over a year and a half now.
How was that experience dealing with your first fire only two weeks into the job?
Pretty scary.
Okay. Can you orchestrate that?
Yeah. I mean, it's anxiety, right? And then you're not as familiar with the environment yet. And it's a global environment. It's not like a very tiny environment. So I had to learn a lot in a very short amount of time.
Mm-hmm.
I had a good teammate, so that's fantastic because they certainly helped soften the blow on it. But yeah, it still was very, very stressful just because the information comes at you like drinking from a fire hose. It's And then for something higher level to happen while you're still trying to drink from that hose, it just it's kind of overwhelming at times.
Overwhelming. Yeah, I think that's the appropriate word. Cool. And so now that you're in this job a year and a half later, what are some things you would either recommend to a year and a half ago, John, or any other person trying to get in? What are some things you would recommend that would have made your transition a little better or, you know, better equipped to get a job similar to yours?
The main thing is to know how the technologies work from the ground up, how a computer works, right?
Mm-hmm.
More so specific to security, if you don't have a college education, definitely CISSP or, you know, SANS has. Has great programs and they have certifications. You want to get some of those information security certifications only because you're never going to get a chance for an interview unless you have something for those auto millers when they're looking through resumes. You need something that allows you to get in the door to do a resume. And especially if you're applying for jobs in bigger businesses, be prepared for multiple interviews, be it if that's phone or in person. But it's going to be more than a single interview when they pick and go through people. So I guess that would be a good suggestion.
So have the stamina to endure multiple interviews.
Correct. Because part of that is, like I said, they're making a decision, right? So they want to see if you're going to have the wherewithal and you're going to have the fortitude to see things through. So that's one of the ways they, I won't say weed people out, but it's one of the ways that they use to make sure they've got the best candidate when they're at the end of the road.
Okay. And then any technical things that you would recommend in modern day security?
Yeah, know your NIST frameworks, know the common security frameworks, and definitely you're going to get questions when you get interviewed in a job for information security that's going to be around risk, risk mitigation, you know, and those frameworks. Actually give you a good understanding of not only how to frame the answers to your questions, but how it benefits the business and what would be the best framework to actually implement. Like, let's say they ask you the question, well, we have no standardization or any information security frameworks. Now you've got an answer to that question. What would you recommend? Now you have an answer.
Gotcha. And then know what you're going to recommend, right?
Correct.
Know a little bit about it.
Okay. And be able to speak intelligently about it, right?
Yeah. Cool. Anything else you would like to add? Any advice or recommendations to folks out there looking to seek, especially in today's COVID world?
Right. Well, prepare for a lot of video interviews. So look over your equipment, right? Make sure things are sounding and looking okay and that your systems are working right because you're going to be doing that. And then the main thing is, is just breathe and relax when you're going through an interview. Because your ability to interview well, even over a video is going to make them more inclined to bring you in. Yeah, you just really got to practice and maybe just interview and have somebody help you with a set of questions and how you'd answer and see. That's really important. If you get to the point where somebody's actually giving you a call or interviewing, it's important to have those key skills.
And if you You're not as well like some people in information technology are very vocal and some they're more introverted people.
Right.
So it's rough. It's rough sometimes. So that's the only that's a real recommendation I'd give is if you're not as comfortable speaking to people or multiple people is just practice that piece.
Yeah. I mean, stand in front of a mirror if you have to. I used to do that. I mean, just stand in front of a mirror, just practice your lines, go through the questions and even the basics, you know, explain TCP IP or any of the other questions that are asked there. But like even just sounding it off to yourself will help reinforce that. And now in the video world or whatever it may be, you know, just do it in front of a mirror or turn on your camera beforehand. Right. Right. Definitely. Yeah. Cool. Well, thank you, John. I think this was helpful. Thank you for sharing your experience. It's quite interesting. All the different milestones your career has went through in the past.
Yeah. Thank you so much for having me. I really appreciate it.
Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon. Thank you.
